I’m trying to setup and familiarize myself with a new install of version 0.16.16 on a Debian Trixie box.
The DNS management task is failing when trying to update our local Bind server with the error “hmac validation failure”. That error sounds pretty straightforward, and suggests to me that I entered the key name or secret value into the WebUI wrong.
However, I can update the Bind server with some of the same records from the Stalwart host’s CLI using nsupdate and the same HMAC-SHA512 key. I’ve verified/re-entered the key details into the WebUI a few times so I’m pretty sure they’re solid unless they need to be formatted in some special way.
Any ideas what I may have done wrong?
Thanks
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
First check the algorithm. The dropdown lists both hmac-sha512 and hmac-sha512-256 and they’re different algorithms; BIND’s hmac-sha512 is the full-length one. If you picked the truncated entry that alone produces this error. Your secret is fine either way, since we base64-decode it and a bad value would have failed with a decode error instead, so paste it exactly as it appears in the secret line with no quotes. The key name is parsed strictly as ASCII and has to match the key stanza name character for character.
Second, clock skew. We sign with a 60 second TSIG fudge; nsupdate defaults to 300. So if the Stalwart host and the BIND host are more than a minute apart, we get rejected and nsupdate from the same machine still works, which is exactly the shape you’re describing. Worth running timedatectl or chronyc tracking on both.
The error text comes from the signature verification path and doesn’t say which side rejected it, so BIND’s own log at the moment of the attempt will settle it. If you can post that, plus which algorithm entry you chose and the allow-update or update-policy clause on the zone, I can narrow it further.
Thank you so much for the settings to double-check. I’m embarrassed to say I ended up figuring out that I had pointed it to the wrong DNS server (one that’s only serving internal DNS). {Hangs head in shame} Once it was set correctly, DNS updates were successful and ACME started functioning.
